{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 5 to 11 October 2026 (week 41)","summary":"In the week of 5 to 11 October 2026, 5 vulnerabilities were newly recorded as exploited in the wild, 5 of them critical. The technology hit most was @strapi/strapi (npm) (1), followed by Apache Struts (1) and Isc BIND (1).","url":"https://junglewise.ai/threats/exploited/2026-10-05","json_url":"https://junglewise.ai/threats/exploited/2026-10-05.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-10-05","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":5,"period":{"end":"2026-10-11","start":"2026-10-05"},"critical":5,"generated_at":"2026-10-13T00:07:00.15766+00:00","technologies":[{"hub":true,"name":"@strapi/strapi (npm)","slug":"strapi-strapi","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/strapi-strapi"},{"hub":true,"name":"Apache Struts","slug":"struts","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/struts"},{"hub":true,"name":"Isc BIND","slug":"bind","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/bind"},{"hub":false,"name":"ONLYOFFICE Docs","slug":"onlyoffice-docs","vulnerabilities":1},{"hub":false,"name":"ONLYOFFICE Docs Server","slug":"docs-server","vulnerabilities":1},{"hub":true,"name":"org.apache.struts:struts2-core (Maven)","slug":"org-apache-struts-struts2-core","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core"},{"hub":true,"name":"Proftpd","slug":"proftpd","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/proftpd"},{"hub":false,"name":"Strapi","slug":"strapi-strapi-1","vulnerabilities":1}],"vulnerabilities":[{"cve":"CVE-2015-3306","epss":0.9675,"slug":"cve-2015-3306-proftpd-improper-access-control-vulnerability","title":"ProFTPD improper access control in SITE commands","severity":"critical","exploited":true,"published_at":"2026-10-08T00:00:00+00:00","technologies":[{"hub":true,"name":"Proftpd","slug":"proftpd","vendor":{"name":"Proftpd","slug":"proftpd"}}],"exploited_since":"2026-10-08T18:06:10.050173+00:00","url":"https://junglewise.ai/threats/cve-2015-3306-proftpd-improper-access-control-vulnerability"},{"cve":"CVE-2021-3199","epss":0.0822,"slug":"cve-2021-3199-onlyoffice-docs-server-path-traversal-vulnerability","title":"ONLYOFFICE Docs Server path traversal in image upload","severity":"critical","exploited":true,"published_at":"2026-10-08T00:00:00+00:00","technologies":[{"hub":false,"name":"ONLYOFFICE Docs Server","slug":"docs-server","vendor":{"name":"ONLYOFFICE","slug":"onlyoffice"}},{"hub":false,"name":"ONLYOFFICE Docs","slug":"onlyoffice-docs","vendor":{"name":"ONLYOFFICE","slug":"onlyoffice"}}],"exploited_since":"2026-10-08T18:06:09.455177+00:00","url":"https://junglewise.ai/threats/cve-2021-3199-onlyoffice-docs-server-path-traversal-vulnerability"},{"cve":"CVE-2016-3081","cvss":3,"epss":0.9335,"slug":"cve-2016-3081-apache-struts-rce-vulnerability","title":"Apache Struts command injection in Dynamic Method Invocation","severity":"critical","exploited":true,"published_at":"2022-05-14T00:54:14+00:00","technologies":[{"hub":true,"name":"org.apache.struts:struts2-core (Maven)","slug":"org-apache-struts-struts2-core","vendor":{"name":"Maven","slug":"maven"}},{"hub":true,"name":"Apache Struts","slug":"struts","vendor":{"name":"Apache","slug":"apache"}}],"exploited_since":"2026-10-08T18:06:09.085479+00:00","url":"https://junglewise.ai/threats/cve-2016-3081-apache-struts-rce-vulnerability"},{"cve":"CVE-2015-5477","epss":0.9128,"slug":"cve-2015-5477-isc-bind-data-processing-errors-vulnerability","title":"ISC BIND denial of service via TKEY queries","severity":"critical","exploited":true,"published_at":"2026-10-08T00:00:00+00:00","technologies":[{"hub":true,"name":"Isc BIND","slug":"bind","vendor":{"name":"Isc","slug":"isc"}}],"exploited_since":"2026-10-08T18:06:08.939383+00:00","url":"https://junglewise.ai/threats/cve-2015-5477-isc-bind-data-processing-errors-vulnerability"},{"cve":"CVE-2023-22894","cvss":3.1,"epss":0.0166,"slug":"cve-2023-22894-strapi-information-disclosure-via-private-field-filtering","title":"Strapi information disclosure via private field filtering","severity":"critical","exploited":true,"published_at":"2023-04-19T21:41:26+00:00","technologies":[{"hub":true,"name":"@strapi/strapi (npm)","slug":"strapi-strapi","vendor":{"name":"npm","slug":"npm"}},{"hub":false,"name":"Strapi","slug":"strapi-strapi-1","vendor":{"name":"Strapi","slug":"strapi"}}],"exploited_since":"2026-10-08T18:06:07.776873+00:00","url":"https://junglewise.ai/threats/cve-2023-22894-strapi-information-disclosure-via-private-field-filtering"}],"previous":{"key":"2026-09-28","top":"Zammad","total":6,"period":{"end":"2026-10-04","start":"2026-09-28"},"critical":6,"url":"https://junglewise.ai/threats/exploited/2026-09-28"},"next":{"key":"2026-10-12","top":"AhsayCBS","total":9,"period":{"end":"2026-10-18","start":"2026-10-12"},"critical":9,"url":"https://junglewise.ai/threats/exploited/2026-10-12"}}